Hacker Newsnew | past | comments | ask | show | jobs | submit | fromlogin
TanStack NPM Packages Compromised in Ongoing Mini Shai-Hulud Supply-Chain Attack (socket.dev)
2 points by croes 4 hours ago | past | 1 comment
Tanstack NPM Packages Compromised in Ongoing Supply-Chain Attack (socket.dev)
6 points by pier25 17 hours ago | past | 1 comment
PyPI Fixes High-Severity Access Control Issues Found in Security Audit (socket.dev)
1 point by feross 10 days ago | past | discuss
Ruby Gems and Go Modules Impersonate Dev Tools to Steal Secrets and Poison CI (socket.dev)
4 points by ilreb 11 days ago | past | discuss
SAP Cap NPM Packages Hit by Supply Chain Attack (socket.dev)
2 points by salkahfi 12 days ago | past | discuss
Socket Has Acquired Secure Annex (socket.dev)
3 points by ilreb 13 days ago | past | discuss
Namastex.ai NPM Packages Hit with TeamPCP-Style CanisterWorm Malware (socket.dev)
1 point by My_Name 15 days ago | past
Open VSX Sleeper Extensions Linked to GlassWorm Show New Malware Activations (socket.dev)
1 point by salkahfi 17 days ago | past
Introducing Data Exports (socket.dev)
1 point by ilreb 18 days ago | past
Malicious Checkmarx Artifacts Found in Official KICS Docker Repository (socket.dev)
1 point by darkwater 18 days ago | past
Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign (socket.dev)
872 points by tosh 18 days ago | past | 431 comments
Malicious Checkmarx Artifacts Found in Official KICS Docker Repo and Code Ext (socket.dev)
3 points by orkj 19 days ago | past
Malicious Checkmarx Artifacts Found in Official KICS Docker Repository (socket.dev)
4 points by justsomehuman 19 days ago | past
108 Chrome Extensions Linked to Data Exfiltration and Session Theft via C2 (socket.dev)
6 points by jbegley 28 days ago | past
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline (socket.dev)
3 points by salkahfi 31 days ago | past | 1 comment
North Korea's Contagious Interview Campaign Spreads Across 5 Ecosystems (socket.dev)
2 points by pier25 34 days ago | past
Attackers Are Hunting High-Impact Node.js Maintainers with Social Engineering (socket.dev)
3 points by pier25 38 days ago | past | 2 comments
Axios Maintainer Confirms Social Engineering Attack Behind NPM Compromise (socket.dev)
5 points by feross 39 days ago | past
The Hidden Blast Radius of the Axios Compromise (socket.dev)
6 points by feross 40 days ago | past
Supply Chain Attack on Axios Pulls Malicious Dependency from NPM (socket.dev)
2 points by dsr12 42 days ago | past
TeamPCP Is Systematically Targeting Security Tools Across the OSS Ecosystem (socket.dev)
5 points by pier25 48 days ago | past
Trivy Supply Chain Attack Expands to Compromised Docker Images (socket.dev)
5 points by feross 50 days ago | past | 3 comments
Trivy under attack again: Widespread GitHub Actions tag compromise secrets (socket.dev)
250 points by jicea 51 days ago | past | 83 comments
Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes (socket.dev)
3 points by tamnd 52 days ago | past | 1 comment
CanisterWorm: NPM Publisher Compromise Deploys Backdoor Across 29 Packages (socket.dev)
3 points by pier25 52 days ago | past
Widespread Trivvy GitHub Actions Tag Compromise Exposes CI/CD Secrets (socket.dev)
7 points by donutshop 53 days ago | past | 1 comment
Enisa Technical Advisory on Secure Use of Package Managers (socket.dev)
6 points by pier25 53 days ago | past
Malicious NPM Packages Use Pastebin Steganography to Deploy Credential Stealer (socket.dev)
2 points by feross 73 days ago | past
Malicious Go "Crypto" Module Steals Passwords and Deploys Rekoobe Backdoor (socket.dev)
3 points by feross 74 days ago | past
Shai-Hulud-Style NPM Worm Hijacks CI Workflows and Poisons AI Toolchains (socket.dev)
10 points by jicea 79 days ago | past

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: